Not rated
CVE-2019-3772 Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older…
Description
Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Integration 5.1 | 5.1 → < 5.1.1.RELEASE | 5.1.1.RELEASE |
| Spring Integration 5.0 | 5.0 → < 5.0.10.RELEASE | 5.0.10.RELEASE |
| Spring Integration 4.3 | 4.3 → < 4.3.18.RELEASE | 4.3.18.RELEASE |
References
- pivotal.io pivotal.io
- www.oracle.com www.oracle.com
- 106749 www.securityfocus.com
Timeline
- Published
- Last modified
Other CVEs of Spring Integration
The 16 CVEs of Spring Integration →
CVE-2026-59324
When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads,…
8.2
High
CVE-2026-59322
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor
6.3
Medium
CVE-2026-59321
A single ScriptEngine instance is reused for every message on a script-backed channel
4.2
Medium
CVE-2026-59311
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their…
6.8
Medium